Large companies employ numerous employees and these employees operate their respective company's systems to execute a variety of tasks. Such large companies have found that reviewing and monitoring the authorization level of their employees and the executed tasks is time-consuming and inefficient. However, the review of employees and their system usage is important in order to: ensure efficient operation, avoid wasteful overlaps, control the unauthorized sharing of confidential information, and effectively report on compliance with rules by technologies, people, processes, and information.
Accordingly, these large companies have adopted real-time ad-hoc Risk Analysis (RA) software and associate systems to perform these monitoring tasks on their behalf. In Enterprise Resource Planning (ERP) systems, customers use Risk Analysis (RA) to comply with an owner's provided audit requirements. RA is generally implemented to detect Segregation of Duties (SoD) violations, which indicate whether different users and tasks involved in the ERP systems are properly authorized to: create, delete, access (read, write, send), and manipulate different portions of the ERP systems.
When the conventional RA is implemented, analysis can be extremely time-consuming. Moreover, the time-consuming analysis must be completed in order for the customer to be provided with the audit report. Each time the user requests the report, a full analysis of the system must be repeated. The audit report is typically in the form of an SoD analysis report.
ERP systems performing the conventional RA generally access, analyze, and report the status of RA applications in accordance with the following. First, each database that is a part of the ERP system and governed by the RA audit must be accounted for. Then, each accounted for database has all of its data rules and authorization rules synchronized onto a backend environment. After the full synchronization of all of the databases, the backend system compares the synchronized data rules and authorization rules to a pre-defined set of rules stored at the backend.
The analysis of the conventional RA is generally time consuming for several reasons. One reason is that each time an RA is executed, the RA acts as a trigger to initiate the RA process. Only upon the trigger does the ERP system identify which data tables are needed and then proceeds to pull relevant data from those identified data tables in the source systems. After having identified and accessed the relevant data, the ERP system proceeds to check each role, action, and permission level from the accessed data according to a pre-defined set of rules.
The comparison results from the check are stored and used to generate the SoD analysis report. Each time, however, a database associated with the ERP system expands to account for data developments or changes in local infrastructure associated with the company, additional unknown and unconfirmed data exists locally in the source system that has not been subjected to a RA by the ERP system.
The assessment report is historically only stored, in conventional RA, after a full compare is run. The assessment report is then stored locally upon the customer's device. The assessment report includes information regarding what violation occurred, which parties were responsible, and which tasks triggered the violation. In convention applications, violation reports are often presented to the users at consistent intervals. For example, violation reports may be presented month by month.
In many environments, such as Information Technology (IT) environments, multiple ERP systems are used as source data based on customer needs and requirements. Similarly, customer needs and requirements result in the multiple ERP systems handling a high volume of RAs. Due to the voluminous number of ERP systems needed for these environment systems, conventional RA has not been scalable.
In addition, scalability is further complicated given that high volume maintenance activities are often required. In some circumstances, the amount of maintenance is driven due to the various plug-in dependencies of each of, or some of, the ERP systems and edge components associated with the ERP systems. Conventional RA, sometimes referred to herein as ad-hoc RA, is also not scalable because any synchronization of the ERP systems requires a great deal of time. In many environments, the data to be accessed for the RA is voluminous and constantly increasing as the database tables grow to support various customer needs.
Furthermore, the procedure to execute the real-time ad-hoc RA requires a large amount of memory on the backend server environment. The generation of the SoD analysis report further consumes significant application-specific programming memory.
Accordingly, there is a need for methods and systems to dynamically assess user permissions and report the assessment to an administrator of a system, without delay, in response to a triggering event.